/etc/rsyslog.d/haproxy.conf

haproxy log-format-http

log-format client_ip:%ci\tclient_port_int:%cp\tdate_time:%t\tfrontend_name:%ft\tbackend_name:%b\tserver_name:%s\ttime_request_int:%Tq\ttime_queue_int:%Tw\ttime_backend_connect_int:%Tc\ttime_backend_response_int:%Tr\ttime_duration_int:%Tt\thttp_status_code_int:%ST\tbytes_read_int:%B\tcaptured_request_cookie:%CC\tcaptured_response_cookie:%CS\ttermination_state:%tsc\tactconn_int:%ac\tfeconn_int:%fc\tbeconn_int:%bc\tsrvconn_int:%sc\tretries_int:%rc\tsrv_queue_int:%sq\tbackend_queue_int:%bq\tcaptured_request_headers:%hr\tcaptured_response_headers:%hs\thttp_request:%r\tmessage:%ci:%cp\ [%t]\ %ft\ %b/%s\ %Tq/%Tw/%Tc/%Tr/%Tt\ %ST\ %B\ %CC\ \ %CS\ %tsc\ %ac/%fc/%bc/%sc/%rc\ %sq/%bq\ %hr\ %hs\ %{+Q}r

haproxy log-format-tcp

log-format client_ip:%ci\tclient_port_int:%cp\tdate_time:%t\tfrontend_name:%ft\tbackend_name:%b\tserver_name:%s\ttime_queue_int:%Tw\ttime_backend_connect_int:%Tc\ttime_duration_int:%Tt\tbytes_read_int:%B\ttermination_state:%ts\tactconn_int:%ac\tfeconn_int:%fc\tbeconn_int:%bc\tsrvconn_int:%sc\tretries_int:%rc\tsrv_queue_int:%sq\tbackend_queue_int:%bq\tmessage:%ci:%cp\ [%t]\ %ft\ %b/%s\ %Tw/%Tc/%Tt\ %B\ %ts\ %ac/%fc/%bc/%sc/%rc\ %sq/%bq

logrotate haproxy

#/etc/logrotate.d/haproxy
/var/log/haproxy.log {
    daily
    rotate 6
    missingok
    notifempty
    compress
    postrotate
        invoke-rc.d rsyslog rotate >/dev/null 2>&1 || true
    endscript
}

/var/log/haproxy-errors.log {
    daily
    rotate 6
    missingok
    notifempty
    compress
    postrotate
        invoke-rc.d rsyslog rotate >/dev/null 2>&1 || true
    endscript
}

rsyslog haproxy.conf

#/etc/rsyslog.d/haproxy.conf
module(load="mmutf8fix")
action(type="mmutf8fix")

$MaxMessageSize 32k
$EscapeControlCharactersOnReceive off
$DefaultNetstreamDriverCAFile /etc/ssl/certs/XXX.logs.ovh.com.pem
$DefaultNetstreamDriver gtls # use gtls netstream driver
$ActionSendStreamDriverMode 1 # require TLS for the connection
$ActionSendStreamDriverAuthMode anon # server is NOT authenticated
$AddUnixListenSocket /var/lib/haproxy/dev/log

$ModLoad imuxsock # local message reception
$WorkDirectory /var/spool/rsyslog # default location for work (spool) files
$ActionQueueType LinkedList # use asynchronous processing
$ActionQueueFileName srvrfwd # set file name, also enables disk mode
$ActionResumeRetryCount -1 # infinite retries on insert failure
$ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down

$template haproxy,"%timestamp:::date-rfc3339% %HOSTNAME% %syslogtag%%msg%\n"
$template ltsv,"X-OVH-TOKEN:XXXXXXXXXXXXXXXX\9time:%timestamp:::date-rfc3339%\9host:%HOSTNAME%\9level:%syslogseverity%\9facility:%syslogfacility%\9program:%app-name%\9pid:%procid%\9%msg:2:2768%\n"
$template ltsv_fix,"X-OVH-TOKEN:XXXXXXXXXXXXXXXX\9time:%timestamp:::date-rfc3339%\9host:%HOSTNAME%\9level:%syslogseverity%\9facility:%syslogfacility%\9program:%app-name%\9pid:%procid%\9message:%msg:2:2768%\n"

# Send HAProxy messages to ovh data plaforms
if ( $programname startswith 'haproxy' then {
if $msg contains '	' then {
@@XXX.logs.ovh.com:12201;ltsv
} else {
@@XXX.logs.ovh.com:12201;ltsv_fix
}
}

# Send HAProxy messages to a dedicated logfile
if ( \
  $programname contains 'haproxy' and \
  ($syslogseverity < 4 ) \
) then -/var/log/haproxy-errors.log
& stop

if ( \
  $programname contains 'haproxy' and \
  ( ($syslogseverity >= 4 /* 4=notice */ ) \
) then -/var/log/haproxy.log
& stop